Review of the to-be layer: check what the documents claim against what runs

First pass of a design review, done by reading documents against code
and against a raised mesh rather than against each other. Every error
below was invisible to a proofread.

**Statuses were stale, and nothing checked them.** Ten to-be documents
said `designed` while naming working, lab-proven code — several with a
*What was built* or *Raised, and observed* section. Added a
`status-vs-code` check: naming a file is a claim that the file
implements this, so a document that points at one has stopped being
merely designed. It failed on all ten before it passed, per the rule
this folder sets for its own checks.

**The bundle carries three images, not two.** 07 reasoned about which
substrate services go in and overlooked that the control plane is in
there too — it is what the substrate exists to start, and there is
nothing to fetch it with yet. Counted, not deduced.

**The bootstrap uses four shapes, not six.** It listed `file` and
`directory`, which substrate-first-node.lock never asks for. The claim
that mattered — nothing is blocked on the host — was true either way,
which is why the wrong count survived.

**The eight capabilities were documented nowhere.** Implemented in
internal/profile/detectors.go and enumerated in no document, including
the one about the host that detects them. A vocabulary modules write
against, readable only by reading the code. Now written down, with the
seat/graphical-session distinction that is wrong in both directions if
collapsed.

**MinIO swept out of the to-be layer** per 0028.

The gate now fails on one thing left deliberately: ADR 0024 is
`proposed` while two documents rest on it and the feature it decides is
built and lab-proven. Accepting a decision is not mine to do.

03-DESIGN/01-to-be/06-the-control-plane.md

@@ -1,9 +1,9 @@
 ---
 layer: to-be
-status: designed
+status: in-progress
 code:
   - mesh-control
-updated: 2026-08-29
+updated: 2026-08-31
 decisions:
   - 02-DECISIONS/0001-mesh-brokers-nodes-host-agents-think.md
   - 02-DECISIONS/0005-the-node-host.md
@@ -177,7 +177,7 @@ volume genuinely argues against a relational store.
   node except through the host.
 - **Not a surface.** Tier 3 is how people and agents reach it. It has one interface; the
   surfaces are what speak to that interface.
-- **Not the substrate.** It *runs on* tier 1 — PostgreSQL, LavinMQ, MinIO, an OCI registry
+- **Not the substrate.** It *runs on* tier 1 — PostgreSQL, LavinMQ, an OCI registry
   ([ADR 0006](../../02-DECISIONS/0006-the-substrate-and-the-control-plane.md)) — and cannot start without
   them, which is what makes them a lower tier.
 - **Not privileged on a node.** It has no more access to a machine than the declaration